CVE-2026-99243

In the Linux kernel, the following vulnerability has been resolved:

io-wq: order the exit bit against worker creation task work

io wq exit workers() cancels task work for queued worker creation with task work cancel match(). That has a plain load of task->task works.

io queue worker create() adds the new entry and tests IO WQ BIT EXIT to cancel it if the workqueue is already on its way out.

That must be ordered. task work add() has a full barrier via cmpxchg(). But io wq exit start() sets the bit with set bit() which doesn't have any memory ordering.

So afaict, on weakly ordered architectures the exiting task may load task works before the store of the bit is visible. The other side tests the bit before the store is visible as well. So the entry remains queued with worker refs and the exiting task waits on worker done indefinitely.

If the task still has rings then io uring del tctx node() provides the barrier via test and set bit() in io wq set exit on idle(). When it has closed all rings though that barrier is gone.

Add the barrier after the set bit().